PHP
- Exploited flaws
- 3in 3 products
- Added to CISA's list in 2026
- 01 in 2025
- Used by ransomware
- 1of 3, says CISA
- Disclosure to CISA's list
- Not yet3 of 3 flaws dated so far; filling in daily
Exploited flaws by the year they were disclosed
The year in each CVE ID, roughly when the flaw became public. Recent years can still grow: flaws are often exploited, and listed, years later.
Hover or tab through a year for its count.
Show as a table
| Year disclosed | Exploited flaws |
|---|---|
| 2012 | 1 |
| 2013 | 0 |
| 2014 | 0 |
| 2015 | 0 |
| 2016 | 1 |
| 2017 | 0 |
| 2018 | 0 |
| 2019 | 1 |
| 2020 | 0 |
| 2021 | 0 |
| 2022 | 0 |
| 2023 | 0 |
| 2024 | 0 |
| 2025 | 0 |
| 2026 | 0 |
Products exploited more than once
No product has had more than one flaw on CISA's list.
Latest on CISA's list
In the news
- PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw
- Widespread PHP Flaw May Cause Many Site Outages Today
- PHP shares mitigation for new RCE vulnerability with no patch
- URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
- New Serious PHP Vulnerabilities Released and Patched
- PHP vulnerability: Websites go offline amid critical security update
- PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
- PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
From CISA's Known Exploited Vulnerabilities catalogue. "Disclosure to CISA's list" uses NVD's publication date and leaves out the 2021-11-03 launch, when CISA added hundreds of older flaws at once; CISA often lists a flaw after attacks have begun, so it's an upper limit on how fast exploitation came.